Description

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_request_format_response. The final-label check permits j plus label_len plus one to equal buf_len, after which the terminating null byte is written to buf[buf_len]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger the one-byte out-of-bounds write and crash or corrupt the process. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.0",
  "pubDate": "2026-08-20T18:16:36.723Z",
  "pubdate": "2026-08-20T18:16:36.723Z",
  "executiveSummary": "Libevent contains an off-by-one stack buffer overflow vulnerability located in the evdns.c source file.\nThe vulnerability affects Libevent prior to versions 2.1.13 and 2.2.2-alpha.\nAn attacker capable of providing a crafted DNS server response can trigger a one-byte out-of-bounds write on a 64 KB stack buffer allocated by the evdns_server_request_format_response function.\nSuccessful exploitation of this flaw can result in application crashes or memory corruption within the process, posing a risk of denial of service or potentially arbitrary memory alteration depending on the surrounding stack layout.\nThe vulnerability is triggered by processing specially crafted DNS records containing PTR, CNAME, MX, NS, or SOA data.\nNo specific authentication or high privileges are explicitly stated as requirements for exploitation, provided the vulnerable application processes the malicious DNS responses.",
  "technicalDetails": "The vulnerability stems from an off-by-one stack buffer overflow condition in the dnsname_to_labels function within evdns.c.\nDuring the formatting of name-bearing DNS records at the end of a 64 KB stack buffer allocated by evdns_server_request_format_response, the final-label boundary check is improperly validated.\nSpecifically, the boundary logic permits the calculation of j plus label_len plus one to precisely equal buf_len.\nAs a direct consequence of this arithmetic allowance, the routine proceeds to write the terminating null byte out-of-bounds to buf[buf_len].\nThe attack vector requires a crafted DNS server response containing specific record types, specifically PTR, CNAME, MX, NS, or SOA data.\nWhen the vulnerable Libevent component parses and formats these malformed records, the boundary check fails to prevent the single-byte overflow.\nThe affected component is the DNS server response formatting routine in evdns.c.\nThe affected software versions are all Libevent releases prior to 2.1.13 and 2.2.2-alpha.\nThe payload behavior involves supplying oversized or specifically dimensioned label lengths that satisfy the flawed boundary check.\nThe post-exploitation impact includes stack memory corruption and process termination, resulting in a denial of service condition."
}